In real world, security is done by a bunch of nearly clueless people hoping to put enough hard enough roadblocks to make it practically not worthwhile for you to hack in.
If you don't have mathematically secure solutions, session expiration and similar are the imperfect tools you use to solve your problem.
One beef I have with short session expiration, though, is that in many cases it causes people to degrade security. This happens when people get annoyed by having to frequently provide their credentials and rather than enter credentials securely, use even more insecure workarounds.
This is why I prefer short sessions and requiring frequent, passwordless, biometric authentication. Still relatively low friction for the user, and no password to remember or forget, while still reasonably high friction for an attacker.
The product should have strong privacy built into it and a commitment from the owners to keep it this way. Calling it something mundane and then competing on the merits of the product will favor mass adoption.
How many users of WhatsApp really understand the implications of E2E? Would they have installed it if it was call 'Chat App Privacy Pro'?